Phishing drills have a reputation problem. Done badly, they feel like a trap: staff get caught, get embarrassed, and learn to resent IT. Done well, they are one of the most useful security habits a business can build. Attack simulation training in Microsoft 365 gives you everything you need to run realistic drills inside the tools your staff already use, and to pair each mistake with a short lesson rather than a reprimand.
This guide covers licensing, setup, how to design simulations people actually learn from, and which numbers to track.
What attack simulation training is
Attack simulation training is a feature of Microsoft Defender for Office 365 Plan 2. It lets you send harmless, realistic phishing messages to your own staff, see who clicks, enters credentials, or reports the message, and automatically assign short training to the people who need it.
It lives in the Microsoft Defender portal at Email & collaboration > Attack simulation training, or directly at security.microsoft.com/attacksimulator. From there you can launch simulations, build simulation automations that run on a schedule, and create training campaigns that assign modules without a simulation. Microsoft provides a library of more than 70 training modules.
Licensing: check this first
Attack simulation training needs a Microsoft 365 E5 or Defender for Office 365 Plan 2 license. That license is needed for every user you include in a simulation, not just the admin running it.
Plan
Attack simulation training
Microsoft 365 Business Premium
Not included (includes Defender for Office 365 Plan 1)
Business Premium with Defender for Office 365 Plan 2 add-on
Included for licensed users
Business Premium with Microsoft Defender Suite add-on
Included (the suite contains Plan 2)
Microsoft 365 E3 / Office 365 E3
Limited trial: credential harvest payloads and a small training set only
Microsoft 365 E5
Included
Buying a single Plan 2 license for the admin and simulating against everyone else is a common shortcut, and it does not meet Microsoft’s licensing terms. Budget for every user you plan to include. A 90-day Defender for Office 365 trial is available from the trials hub in the Defender portal if you want to test the program first.
If you are on Business Premium and want this feature, the Defender Suite or a Plan 2 add-on is the usual route. Our E5 vs E3 calculator can help you compare the options.
Setting up your first simulation
Assign the right role. Give the person running the program the Attack Simulation Administrator role rather than Global Administrator. Attack Payload Author is available for someone who only builds payloads.
Make reporting easy. Confirm the built-in Report button is available in Outlook and that user-reported messages are configured in the Defender portal. A drill teaches nothing if people have no simple way to report.
Tell people it is coming. Announce the program, not the date. “We will run occasional practice phishing emails this year. If you spot one, report it. If you click one, you will get a short lesson. Nobody is in trouble.”
Launch a simulation. Go to the Simulations tab and select Launch a simulation. Choose a technique, such as credential harvest, and pick a payload.
Target users. Start with all staff, or a pilot group if you are nervous. Exclude anyone on leave.
Assign training. Let Microsoft recommend training, or pick modules. Keep it short. Five to ten minutes is plenty.
Set the landing page and schedule. Use the default landing page that explains the drill. Spread delivery over a few hours so people do not warn each other.
Because the simulations come from Microsoft’s own service, you do not need to allowlist them in your mail filters the way you would with a third-party phishing tool.
Designing drills staff actually learn from
Match your real threats
Generic “you have won a prize” messages teach little. Use payloads that look like what your business really receives: a shared document notification, a voicemail alert, a delivery notice, an invoice from a supplier-style sender. If your firm handles closings or wire transfers, simulate a change of payment details.
Vary the technique
Attack simulation training supports several techniques, including credential harvest, malware attachment, link in attachment, link to malware, drive-by URL, and OAuth consent grant. Rotating them teaches people that phishing is not just “a link to a fake login page.”
Go gradually harder
Start with easy-to-spot messages. Increase difficulty as your report rate improves. A first drill that catches half the office does not teach. It humiliates.
Reward reporting
The behavior you want most is not “did not click.” It is “reported it.” Mention good report rates in team meetings. Some firms thank the first reporter by name, with their permission.
Never punish
Public shaming or disciplinary action for clicking a simulation destroys trust. Staff stop reporting real incidents because they fear the consequences. The training assignment is the consequence.
Running it as a program, not a one-off
One drill a year is a compliance checkbox. A monthly or bi-monthly rhythm builds a habit. Simulation automations let you set this up once: pick several techniques and payloads, target groups, assign training, and choose a schedule. Microsoft then creates the individual simulation runs for you.
A simple yearly plan for a 20 to 500 person business:
Monthly automated simulation to a random portion of staff, rotating techniques.
Quarterly targeted simulation for finance, HR, and leadership using payment or payroll themes.
Training campaign for all new starters within their first month.
Annual refresher training campaign for everyone.
What to measure
Metric
What it tells you
Direction you want
Click or compromise rate
How many people fell for the drill
Down over time
Report rate
How many people reported the message
Up over time
Time to first report
How fast the business would notice a real campaign
Down over time
Training completion
Whether assigned lessons are being done
Close to 100 percent
Repeat clickers
Who needs more support
A shrinking list
Report rate is the most important of these. A business where most people report suspicious messages quickly can contain a real phishing campaign before much damage is done.
Can I run attack simulation training with Business Premium?
Not on its own. Business Premium includes Defender for Office 365 Plan 1. Attack simulation training needs Plan 2, which you can add through a Plan 2 add-on or the Microsoft Defender Suite for Business Premium.
How often should we run phishing simulations?
Monthly or every other month works well for most businesses. Regular, varied drills build a reporting habit. A single annual test mostly measures how many people forgot last year’s training.
Should we tell staff about phishing simulations?
Yes, tell them the program exists and why, but not when each drill will run. Being open about the program builds trust and makes people more willing to report real phishing.
Want phishing drills that build skills instead of resentment? Book a free Microsoft 365 security assessment and we will review your email defenses and recommend a training program that fits your team.
Phishing drills have a reputation problem. Done badly, they feel like a trap: staff get caught, get embarrassed, and learn to resent IT. Done well, they are one of the most useful security habits a business can build. Attack simulation training in Microsoft 365 gives you everything you need to run realistic drills inside the tools your staff already use, and to pair each mistake with a short lesson rather than a reprimand.
This guide covers licensing, setup, how to design simulations people actually learn from, and which numbers to track.
What attack simulation training is
Attack simulation training is a feature of Microsoft Defender for Office 365 Plan 2. It lets you send harmless, realistic phishing messages to your own staff, see who clicks, enters credentials, or reports the message, and automatically assign short training to the people who need it.
It lives in the Microsoft Defender portal at
Email & collaboration > Attack simulation training, or directly atsecurity.microsoft.com/attacksimulator. From there you can launch simulations, build simulation automations that run on a schedule, and create training campaigns that assign modules without a simulation. Microsoft provides a library of more than 70 training modules.Licensing: check this first
Attack simulation training needs a Microsoft 365 E5 or Defender for Office 365 Plan 2 license. That license is needed for every user you include in a simulation, not just the admin running it.
Buying a single Plan 2 license for the admin and simulating against everyone else is a common shortcut, and it does not meet Microsoft’s licensing terms. Budget for every user you plan to include. A 90-day Defender for Office 365 trial is available from the trials hub in the Defender portal if you want to test the program first.
If you are on Business Premium and want this feature, the Defender Suite or a Plan 2 add-on is the usual route. Our E5 vs E3 calculator can help you compare the options.
Setting up your first simulation
Because the simulations come from Microsoft’s own service, you do not need to allowlist them in your mail filters the way you would with a third-party phishing tool.
Designing drills staff actually learn from
Match your real threats
Generic “you have won a prize” messages teach little. Use payloads that look like what your business really receives: a shared document notification, a voicemail alert, a delivery notice, an invoice from a supplier-style sender. If your firm handles closings or wire transfers, simulate a change of payment details.
Vary the technique
Attack simulation training supports several techniques, including credential harvest, malware attachment, link in attachment, link to malware, drive-by URL, and OAuth consent grant. Rotating them teaches people that phishing is not just “a link to a fake login page.”
Go gradually harder
Start with easy-to-spot messages. Increase difficulty as your report rate improves. A first drill that catches half the office does not teach. It humiliates.
Reward reporting
The behavior you want most is not “did not click.” It is “reported it.” Mention good report rates in team meetings. Some firms thank the first reporter by name, with their permission.
Never punish
Public shaming or disciplinary action for clicking a simulation destroys trust. Staff stop reporting real incidents because they fear the consequences. The training assignment is the consequence.
Running it as a program, not a one-off
One drill a year is a compliance checkbox. A monthly or bi-monthly rhythm builds a habit. Simulation automations let you set this up once: pick several techniques and payloads, target groups, assign training, and choose a schedule. Microsoft then creates the individual simulation runs for you.
A simple yearly plan for a 20 to 500 person business:
What to measure
Report rate is the most important of these. A business where most people report suspicious messages quickly can contain a real phishing campaign before much damage is done.
If you would rather have the program run for you, our security awareness training service designs and manages drills and reporting. It works well alongside Defender for Office 365 configuration and our wider managed security service. Microsoft’s setup reference is get started using Attack simulation training.
Frequently asked questions
Can I run attack simulation training with Business Premium?
Not on its own. Business Premium includes Defender for Office 365 Plan 1. Attack simulation training needs Plan 2, which you can add through a Plan 2 add-on or the Microsoft Defender Suite for Business Premium.
How often should we run phishing simulations?
Monthly or every other month works well for most businesses. Regular, varied drills build a reporting habit. A single annual test mostly measures how many people forgot last year’s training.
Should we tell staff about phishing simulations?
Yes, tell them the program exists and why, but not when each drill will run. Being open about the program builds trust and makes people more willing to report real phishing.
Want phishing drills that build skills instead of resentment? Book a free Microsoft 365 security assessment and we will review your email defenses and recommend a training program that fits your team.